Claude Duet Asks Before It Acts. The Risk Is Everything It Reads Before Then

Anthropic opened a research preview of Claude Duet on 21 October 2026. Duet is a standalone app, on the web and on iOS, in which Claude works as a proactive agent rather than waiting to be asked. It sends a short morning brief on what matters across your connected apps, checks those apps every few hours, sends an alert when something needs attention, and keeps working on tasks after you step away. It runs on Opus 5.5 in the cloud, with its own virtual machine and browser, so it does not need access to a local computer. Access is through a waitlist and is limited to Pro and Max subscribers in the United States. Team and Enterprise plans are not included yet.

Launch coverage positions Duet against OpenAI Dots, which we covered after DevDay last month, and Meta Muse. The products differ in detail, but the governance shape is the same and it is worth stating plainly. The first background agent to read your company inbox will most likely run on a plan an individual bought, because that is the only plan it ships on. With Dots, Enterprise at least had an admin gated beta. With Duet there is no workspace version at all during the preview, which means there is no admin console, no workspace level connector policy and no organisation owned audit log for it. If a member of staff uses Duet with company systems today, the only control points you hold are the ones outside Anthropic: the identity grants, the device and the policy.

Anthropic has put clear limits on what Duet does on its own. It asks for approval before it sends a message, makes a payment, signs a document or deletes a file. It does not see passwords or logins when it is given account access, and a dedicated classifier and safety system prompt screen each message to guard against leaks of sensitive information. Those are sensible defaults and better than many agent products ship with. Notice, though, what the approval list covers. It gates actions that leave a mark. It does not gate reading. An agent that checks email, Slack and calendars every few hours, by design, reads everything those connectors expose, summarises it, and keeps it in a long running thread and in account memory. For most organisations that read path is the larger exposure, and it is not something an approval prompt can catch.

This is the distinction between action risk and data risk, and frameworks treat them differently. Action risk sits under change and authorisation controls: who approved this message, this payment, this deletion. Duet handles that reasonably well for the user, though the approval is recorded in a personal account you cannot query. Data risk sits under classification, transfer and processing controls. ISO 27001 Annex A 5.12 to 5.14 on classification and information transfer, 5.23 on the use of cloud services and 5.34 on privacy and personal information all apply when customer email is continuously read into a third party service under consumer terms. For SOC 2, CC6.1 and CC6.7 cover logical access and the movement of data to external parties. If you hold customer data under contract, the question is whether your data processing agreements permit that customer data to be processed by a personal AI subscription at all, and for most B2B contracts the honest answer is no.

The background usage model creates a second, quieter issue. Duet is included at no extra cost but counts toward the existing plan limits, including work it does in the background. In practice that pushes heavy users toward Max, which is a personal plan that companies frequently reimburse. Expense claims for Claude Max are therefore a reasonable signal of where proactive agents are already touching work data. It also means the person running the agent has an incentive to connect more systems, not fewer, because a brief built from more sources is more useful. Nothing about that is malicious. It is simply how a useful product spreads ahead of policy.

The practical control point is the same one we recommended for Dots. Duet draws on the connectors already linked to a Claude account, and those connectors act through OAuth grants that Google Workspace, Microsoft Entra, Slack and most CRMs let administrators review and restrict. Pull the list of third party app grants to Anthropic and Claude on company accounts this week. For each one, decide whether it is approved, and revoke the rest. If you want to allow Claude for work, the supported path is a Team or Enterprise workspace, where connectors, retention and audit sit under organisation control, and Duet should stay out of scope until Anthropic ships a version for those plans with documented logging.

For ISO 42001, Duet is a new AI system in use, even if nobody procured it. The standard expects an inventory of AI systems, a documented intended use and defined human oversight. A proactive agent that decides for itself what is urgent needs all three written down, including what it is allowed to read, which is the part most AI registers leave out. Anthropic itself says Duet can still misjudge what is urgent, so treat its triage as a suggestion rather than a control, and do not let a morning brief replace a monitored queue for anything with a service level, such as security alerts or customer complaints. Our ISO 42001 guide shows how to record this in an AI register, and the AI governance pages cover how to set oversight that works for agents that act between check ins.

A short list for this week. Update your AI acceptable use policy to say whether proactive or background agents on personal plans may connect to company systems, and name Duet, Dots and Muse as examples so the rule is unambiguous. Review and clean up OAuth grants to Anthropic across your identity provider, Slack and CRM. Check expense claims for Claude Pro and Max. Add a line to your vendor record for Anthropic in Vanta, Drata, Secureframe or Sprinto noting that Duet is a consumer preview with no workspace controls, and set a review date for when a Team or Enterprise version is announced. Our policy templates include an AI acceptable use policy you can extend with these clauses, and the compliance readiness checklist will show where your evidence for third party data transfer is thin.

Our view is that Duet is a careful launch. The approval gates are in the right places for actions, and the decision to keep it in the cloud rather than on a local machine shrinks the endpoint blast radius that worried us with other agents. The gap is not in the product. It is that a well behaved agent reading company data on a personal plan is still company data on a personal plan. Approval before acting is the right default. Approval before reading, set by the organisation that owns the data, is the control you will need to show an auditor, and today you can only enforce it at the grant.